PRIVACY POLICY.

PROVISION OF THE WEBSITE AND CREATION OF LOG FILES
When you visit our website, information is automatically sent to the server of our website by the browser used on your end device. This information is temporarily stored in a log file. The following information is collected without any action on your part and stored until it is automatically deleted:
– IP address of the requesting computer
– date and time of access
– name and URL of the file accessed
– website from which the access was made
– browser used and, if applicable, the operating system of your computer and the name of your browser. the operating system of your computer and the name of your access provider
We process the aforementioned data for the following purposes:
– ensuring a smooth connection to the website
– ensuring convenient use of the website
– evaluation of system security and stability
– error analysis
– for other administrative purposes
The legal basis for data processing is Art. 6 para. 1 lit. f) GDPR. Our legitimate interest follows from the data collection purposes listed above. Under no circumstances do we use the data collected for the purpose of drawing conclusions about your person.

The legitimate interest for this processing is as follows: The integrity and security of the website, which is carried out by Security through the collection of logs, in particular IP addresses, in order to detect possible misuse at an early stage and to be able to take measures to reduce damage.

Your personal data is stored by our provider, with whom an order processing contract within the meaning of Art. 28 GDPR has been concluded.

SSL ENCRYPTION
For security reasons, our website uses SSL encryption. This means that transmitted data is protected and cannot be read by unauthorized third parties.
You can recognize an encrypted connection by the fact that the address line of the browser changes from
“http://” to “https://” and by the lock symbol, which is visible in your browser line on the left.

COOKIES
We use cookies to make the use of our website more attractive, user-friendly and effective. These are small text files that are stored on your end device and contain information about the websites visited. Cookies do not damage your computer and do not contain viruses.
By making appropriate changes to your browser settings, you can be informed about the setting of cookies and decide individually whether to accept them or generally exclude them, as well as initiate the automatic deletion of cookies when the browser window is closed. If you deactivate cookies, you may not be able to use all the functions of our website.

COOKIES USED
.bkl.de _gcl_au (3 months) This cookie is used to track and store conversions on the website. .bkl.de _ga_SFCVSZ0RCN (13 months) This cookie is used to count and store page visits.
.bkl.de _ga (13 months) This cookie is used to count and store page visits. .bkl.de _gid (24 hours) Used to distinguish visitors. The aim is to collect data on how the user moves between pages on the website. .bkl.de _gat_UA-5942952-2 (1 minute) This cookie is used to throttle the number of requests that are forwarded to Google. .bkl.de _ga_EH70HBVYW8 (13 months) This cookie is used to count and store page visits. .google.com CONSENT (2 years) The purpose of this cookie is to recognize the consent settings. www.bkl.de In_or (1 day) This cookie is used to recognize the cookie settings made. .youtube.com YSC (end of session) This cookie registers a unique ID to generate statistics of the YouTube videos embedded on the website that the visitor has watched. .youtube.com VISITOR_INFO1_LIVE (1 year) This cookie tries to estimate the bandwidth on websites with embedded YouTube videos. .youtube.com CONSENT (2 years) The purpose of this cookie is to recognize consent settings. .linkedin.com bcookie (2 years) Used to uniquely identify devices accessing LinkedIn in order to detect misuse of the platform. .linkedin.com li_gc (2 years) Used to store the consent of guests to the use of non-mandatory cookies. .linkedin.com lidc (24 hours) Used to facilitate the selection of the data center.

DATA TRANSFER TO THE USA
Among other things, we use tools from companies based in the USA. If these tools are active, your personal data may be transferred and processed there. We would like to point out that the data transfer may take place without special authorization due to the adequacy decision of the EU Commission in combination with the self-certification of the data recipients in the USA in accordance with the EU-US Data Protection Framework (Art. 45 UAbs. DSGVO).
This self-certification has been checked by us and we have concluded an order processing contract with these providers in accordance with Art. 28 GDPR.
If the data recipients in the USA are not certified in accordance with the EU-US Data Protection Framework, we base the data transfer on the EU Commission’s standard contractual clauses (SCCs) in conjunction with a transfer impact assessment.

CONTACTING THE COMPANY
You can contact us at any time. We would like to provide you with the following information:

General contact options
As general contact media, you have the option of contacting us at
– by post,
– by telephone,
– by fax or
– by e-mail.
In order to process your contact request, we will need to store your communication data (e.g. telephone number, e-mail address) and identification data (e.g. name, address).

For this purpose, the legal basis of Art. 6 para. 1 lit. b) GDPR applies only if the contact is based on the initiation of a contract, the execution of an existing contractual relationship or the amendment of a contractual relationship.
For all other cases of contact, the processing is based on the legitimate interest pursuant to Art. 6 para. 1 lit. f) GDPR of the company.
The legitimate interest for this processing is as follows: As a company, we pursue the economic interests of individualizing and optimizing our products, which are declared as economic factors of the company.

Contact option via contact form
You have the option of contacting us via the contact form on the website. For this purpose, the personal data you enter will be stored by us to process your request.
The purpose is to answer your questions and comments about our services. For this purpose, we rely on the legal basis of Art. 6 para. 1 lit. b) GDPR.
If your contact via the contact form is not a contract initiation, the legal basis of Art. 6 para. 1 lit. f) GDPR applies. The legitimate interest for this processing is as follows: As a company, we pursue the economic interests of individualizing and optimizing our products, which are declared as economic factors of the company.

MICROSOFT TEAMS
We use Microsoft Teams, a service provided by Microsoft Corporation, to conduct telephone and video conferences, online meetings and/or online seminars. If online meetings/online seminars are to be recorded, we will inform you of this before the start of the online meeting/online seminar and – if necessary – ask for your (verbal) consent. If you do not wish to be recorded, you can leave the online meeting/online seminar. The following personal data may be processed:
– User details: display name, email address, profile picture (optional), preferred language
– Meeting metadata: e.g. date, time, meeting ID, telephone number, location
– Text, audio and video data: You may have the option of using the chat function in an online meeting/online seminar. In this case, the text entries you make will be processed in order to display them in the online meeting/online seminar.
The scope of the data depends on the information you have provided before or during participation in the online meeting/online seminar.

The transfer of data to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.

The legal basis for the processing of personal data during online meetings is Art. 6 para. 1 lit. b) GDPR.
During the online meeting, the login names of all participants and the generated communication content are displayed and can be viewed by the other participants in the online meeting. The communication content is saved for documentation purposes. If necessary, the online meeting will be recorded and made available to the participants afterwards.

HANDLING APPLICANT DATA
We offer you the opportunity to apply to us (by e-mail, post or via an application form). In the following, we inform you about the scope, purpose and use of your personal data collected during the application process. We assure you that your data will be collected, processed and used in accordance with applicable data protection law and all other statutory provisions and that your data will be treated confidentially.
If you send us an application, we will process your associated personal data (e.g. contact and communication data, application documents, notes taken during job interviews, etc.) to the extent necessary to decide on the establishment of an employment relationship.
The website’s job board offers you the opportunity to apply directly for an advertised position using an application form. If you apply to us via the application form on the website, your personal data will be automatically sent to the Jobrouter applicant management system (provider is JobRouter AG, Besselstraße 26, 68219 Mannheim, Germany). We have concluded an order processing contract with the provider of the system.

The legal basis for this is Art. 6 para. 1 lit. b) GDPR (general contract initiation) and Section 26 para. 1 BDSG under German law (initiation of an employment relationship). Your personal data will only be passed on within our company to employees who are involved in processing your application.

If the application is successful, the data submitted by you will be stored in our data processing systems for the purpose of implementing the employment relationship on the basis of Art. 6 para. 1 lit. b) GDPR and Section 26 para. 1 BDSG.

If we are unable to make you a job offer, you reject a job offer or you withdraw your application, we will store your application documents for a period of 6 months from the end of the procedure. After 6 months, the data will be deleted and the physical application documents destroyed. The retention serves in particular as evidence in the event of a legal dispute. If it is evident that the data will be required after the 6-month period has expired (e.g. due to an impending or pending legal dispute), the data will only be deleted when the purpose for further storage no longer applies.

Inclusion in our applicant pool
If we do not make you a job offer, you may have the opportunity to be included in our applicant pool. If you are accepted, all documents and details from your application will be transferred to the applicant pool so that you can be contacted in the event of suitable vacancies.
Inclusion in the applicant pool is based exclusively on your express consent (Art. 6 para. 1 lit. a) GDPR). Giving consent is voluntary and is not related to the current application process. The data subject can withdraw their consent at any time. In this case, the data from the applicant pool will be irrevocably deleted, provided there are no legal reasons for retention.
The data from the applicant pool will be irrevocably deleted no later than two years after consent has been given.
We use the JobRouter system for our application management. The provider is JobRouter AG, Besselstraße 26, 68219 Mannheim, with whom we have concluded an order processing agreement.

DATA PROCESSING FOR EVENTS (ONLINE AND PRESENCE)
Data processing is carried out for the purpose of registration, acceptance, organization, implementation and quality assurance of the event as well as the distribution of information on further events. Photos or video recordings made at the event may be processed for public relations purposes and published on the Internet or in our publications.

Data processing is carried out on the basis of Art. 6 para. 1 lit. b) GDPR and on the basis of Art. 6 para. 1 lit. f) GDPR. The processing serves the public relations work of the company and thus also serves the competitiveness of the company. Our legitimate interest follows from the data collection purposes listed above, and we also rely on the economic interest of the company in this context.
If you have given us your consent to the processing of photos and video recordings for the above-mentioned purposes, the data processing takes place on the basis of Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future.

Recipients of the data
Your personal data will only be passed on internally to fulfill the stated purposes or to fulfill legal obligations.
All responsible employees are obliged to maintain the confidentiality of your data. Your personal data will not be passed on externally unless there is legal permission to do so or we have your consent to do so. If we use a service provider in the sense of order processing, we nevertheless remain responsible for the protection of your data. All processors are contractually obliged to treat your data confidentially and to process it only within the scope of providing the service.

There are no automated individual decision-making procedures pursuant to Art. 22 GDPR or other profiling measures within the meaning of Art. 4 No. 4 GDPR.

Your data will only be processed within the European Union. Data will not be transferred outside the Union. Should this become necessary, we will inform you of this in advance and ensure that all necessary measures are taken to maintain an appropriate level of data protection.

The legislator has issued a large number of retention periods, which we observe with the utmost care in order to comply with these obligations. In this context, we generally only store your personal data for as long as this is permitted by the defined purpose or as required by law for reasons of proof.

Consent management with Klaro!
We use the consent management tool “Klaro!” on our website to obtain users’ consent to the storage of certain cookies and the use of certain technologies and to document these in compliance with data protection regulations.

Klaro! is an open source software that is operated locally on our servers (self-hosting). Personal data is not passed on to the provider of the tool.

When you visit our website, Klaro! stores a cookie or information in the local memory of your end device, in which the consent you have given or revoked is stored. In particular, the following data is processed:

• Consent status or revocation of consent
• Selected cookie categories and services
• Date of the decision
• Technical information on the browser used

The data is stored in order to be able to prove the legally required consent and to take the cookie settings into account when further pages are accessed.

The legal basis for the processing is Art. 6 para. 1 lit. c GDPR (fulfillment of a legal obligation) and Art. 6 para. 1 lit. f GDPR (legitimate interest in the legally compliant operation of our website).

The stored consent data will be saved until you change or delete your cookie settings or the purpose of data storage no longer applies.

You can revoke or adjust your consent at any time via the cookie settings on our website.

REGISTRATION FOR PROTECTED DOWNLOAD AREA
We process your personal data in order to provide you with access to the protected download area of the website as part of our business relationship. In this area, selected partners have the opportunity to download information.
You will receive the access data (username and password) for this area from your contact person as part of our partnership.
We ask you to change your password after your first login.
Your personal data is processed on the legal basis of Art. 6 para. 1 lit. b) GDPR (performance of contract).
Your personal data required for access to the protected download area will be stored by us for the duration of the business relationship and then deleted. Statutory retention periods remain unaffected by this.

NEWSLETTER
To receive further information about the services of BKL Baukran Logistik GmbH, you can also subscribe to an e-mail newsletter. The so-called double opt-in procedure is used to send the newsletter, i.e. you will only receive a newsletter by e-mail if you have previously expressly confirmed that the newsletter service should be activated. After you have activated the newsletter, you will receive a notification e-mail with an activation link. You will not receive the newsletter until you click on this link. You can deactivate and unsubscribe from the Newsetter at any time by clicking on the unsubscribe link at the end of the newsletter.
Your personal data (e-mail address) is collected and stored in order to be able to send you the newsletter.
The permissibility of this processing is based on Art. 6 para. 1 lit. a) GDPR, according to which processing is permitted if the data subject has given consent to the processing of personal data concerning them for one or more specific purposes. The provision of your data is voluntary, but necessary for receiving the newsletter.
Your data will be deleted after you withdraw your consent, unless the controller has a legitimate interest in further storage. This may be the case if BKL Baukran Logistik GmbH must continue to store your data on the basis of a contract with you. In any case, only the data that is absolutely necessary to achieve the relevant purpose will continue to be stored. The provision of data is neither legally nor contractually required. If you do not provide your data, you will not be able to receive the newsletter.
You can revoke your consent to this processing at any time.
The MailChimp service is used to send the newsletter. “MailChimp” is a service of the US provider The Rocket Science Group, LLC, 675 Ponce de Leon Ave NE Suite 5000, Atlanta, GA 30308, USA.
The data transfer to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.

WEB ANALYSIS WITH MATOMO
We use the open source software Matomo for the statistical analysis of our website. Matomo does not use cookies and completely anonymizes IP addresses so that no personal data is processed. The analysis is carried out exclusively for statistical purposes and to improve our website. All data is stored on our own servers in Germany and is not passed on to third parties.

GOOGLE ANALYTICS
We use the functions of the web analysis service Google Analytics on our website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables us to analyze the behavior of website visitors. In doing so, we receive various usage data, such as page views, length of visit, operating systems used and your origin. This data may be summarized by Google in a profile that is assigned to you or your end device. We can also use Google Analytics to record your mouse and scroll movements and clicks, among other things. Google Analytics also uses various modeling approaches to supplement the data records collected and uses machine learning technologies for data analysis. Google Analytics uses technologies that enable the recognition of you for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to a Google server in the USA and stored there.
Via the consent banner on our website, we actively obtain your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke this consent at any time.
The transfer of data to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.

IP anonymization
In addition, we only use Google Analytics on our website with activated IP anonymization. This means that your IP address will be truncated by Google within the member states of the European Union or in other signatory states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and only shortened there. We have also concluded an order processing contract with Google. Google processes this data on our behalf and thereby enables us to evaluate the use of the website by users, to compile reports on website activity and to collect other information related to website activity and internet usage. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data.
Browser plugin
You can prevent the collection and processing of your data by Google by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de
You can find more information on how Google Analytics handles user data in Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de
Google refers to its data processing conditions in its own privacy policy. https://support.google.com/analytics/answer/3379636?hl=de&ref_topic=2919631.
Storage period
Data stored by Google at user and event level that is linked to cookies, user IDs or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) is anonymized or deleted after 2 months. Details can be found at the following link: https://support.google.com/analytics/answer/7667196?hl=de

GOOGLE TAG MANAGER
We use the functions of Google Tag Manager on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
This is a tag management system that is used for the purpose of managing website tags via an interface.
To monitor system stability and performance, Google Tag Manager may collect some aggregated data about the triggering of tags. This data does not contain any user IP addresses or user-specific identifiers that could be linked to a specific person. If a deactivation has been made by the user at domain or cookie level, this remains in place for all tracking tags implemented with Google Tag Manager. Apart from the data in standard HTTP request logs, which are all deleted within 14 days of receipt, Google Tag Manager does not collect, store or share any information about visitors to our customers’ properties, including the page URLs visited. Google Tag Manager triggers other tags, which in turn may collect data. For more information about our use of Google Tag Manager data, please see the Google Tag Manager Terms of Service at https://support.google.com/tagmanager/answer/7157428 and the Privacy Policy at https://policies.google.com/privacy.
Via the consent banner on our website, we actively obtain your consent in accordance with Art. 6 para. 1 lit. a) GDPR. You can revoke this consent at any time.
The transfer of data to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.

GOOGLE MAPS
We use the map service Google Maps on our website. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to save your IP address. This information is usually transmitted to a Google server in the USA and stored there. The provider of this site has no influence on this data transfer. If Google Maps is activated, Google may use Google Web Fonts for the purpose of uniform display of fonts. When you call up Google Maps, your browser loads the required web fonts into your browser cache in order to display texts and fonts correctly.
Google Maps is used in the interest of an appealing presentation of our online offers and to make it easy to find the places we have indicated on the website. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
The transfer of data to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.
You can find more information on the handling of user data in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

GOOGLE FONTS
We use Google Fonts from Google Ireland Limited, Gordon House, Barrow St, Dublin 4, Ireland on our website in order to display content on our website correctly and graphically appealing across all browsers.
We have integrated the fonts used locally on the website and no connection is established with the Google servers. No personal data is collected from you and transmitted. If you have any questions about Google’s data protection, you can find out more here (note: if you click on this link, you will be redirected to the Google Inc. website).

YOUTUBE
We embed videos from YouTube on our website. The operator is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the transfer of data to YouTube partners is not necessarily excluded by the extended data protection mode. YouTube establishes a connection to the Google DoubleClick network regardless of whether you are watching a video.
As soon as you start a YouTube video on this website, a connection to the YouTube servers is established. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behavior directly to your personal profile. You can prevent this by logging out of your YouTube account.
Furthermore, YouTube may store various cookies on your end device after starting a video or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to record video statistics, improve user-friendliness and prevent fraud attempts.
If necessary, further data processing operations may be triggered after the start of a YouTube video, over which we have no influence.
The use of YouTube is in the interest of an appealing presentation of our online offers. This constitutes a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a) GDPR and § 25 para. 1) TTDSG, insofar as the consent includes the storage of cookies or access to information in the user’s terminal device (e.g. device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.
The data transfer to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.
Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=de.

DATA PROCESSING BY SOCIAL NETWORKS
We maintain publicly accessible profiles in social networks. The individual social networks we use can be found below.
Social networks such as Facebook, Twitter etc. can generally analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). Visiting our social media presences triggers numerous data protection-relevant processing operations.
In detail: If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address.
With the help of the data collected in this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. In this way, interest-based advertising can be displayed to you inside and outside the respective social media presence. If you have an account with the respective social network, the interest-based advertising can be displayed on all devices on which you are logged in or were logged in.
Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

Legal basis
Our social media presences are intended to ensure the widest possible presence on the internet. This is a legitimate interest within the meaning of Art. 6 para. 1 lit. f) GDPR.
The analysis processes initiated by the social networks may be based on different legal bases, which must be specified by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a) GDPR).

Controller and assertion of rights
If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. You can generally assert your rights (information, rectification, erasure, restriction of processing, data portability and complaint) both against us and against the operator of the respective social media portal (e.g. Facebook).
Please note that despite the joint responsibility with the social media portal operators, we do not have full influence on the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

Storage duration
The data collected directly by us via the social media presence will be deleted from our systems as soon as you ask us to delete it, revoke your consent to storage or the purpose for data storage no longer applies. Stored cookies remain on your end device until you delete them. Mandatory statutory provisions – in particular retention periods – remain unaffected.
We have no influence on the storage period of your data that is stored by the operators of social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below).

Social networks in detail
Facebook
We have a profile on Facebook. The provider of this service is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Meta, the data collected is also transferred to the USA and other third countries.
We have concluded a joint processing agreement (Controller Addendum) with Facebook. This agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
You can adjust your advertising settings yourself in your user account. To do this, click on the following link and log in: https://www.facebook.com/settings?tab=ads.
The data transfer to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient in accordance with the EU-US Data Privacy Framework.
Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
Details can be found in Facebook’s privacy policy: https://www.facebook.com/about/privacy/.

Instagram
We have a profile on Instagram. The provider is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to the provider, the data collected is also transferred to the USA and third countries. The data transfer to the USA is based on the adequacy decision of the EU Commission pursuant to Art. 45 para. 1 GDPR in combination with the self-certification of the data recipient pursuant to the EU-US Data Privacy Framework.
Details can be found here: https://privacycenter.instagram.com/policy/, https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.
Details on how they handle your personal data can be found in Instagram’s privacy policy: https://help.instagram.com/519522125107875.

Xing
We use the functions of the XING network on our website, which are offered by New Work SE, Am Strandkai 1, 20457 Hamburg, Germany.
Each time our website is accessed, a connection to XING servers is established. To the best of our knowledge, no personal data is stored, in particular no evaluation of usage behavior takes place and IP addresses are not stored.
You can find more information on data protection and the XING share button in XING’s privacy policy at: https://privacy.xing.com/de/datenschutzerklaerung.

LinkedIn
We use the functions of the LinkedIn network on our website, a service provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. LinkedIn uses advertising cookies. If you wish to deactivate these advertising cookies, please use the following link https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://de.linkedin.com/legal/l/dpa and https://www.linkedin.com/legal/l/eu-sccs.
You can find more information in LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy.

RIGHTS OF THE DATA SUBJECT
Right to information
In accordance with Art. 15 GDPR, you have the right to request information about your personal data that we process. This right includes information about:
– the purposes of processing,
– the categories of personal data,
– the recipients or categories of recipients to whom your data has been or will be disclosed,
– the planned storage period or at least the criteria for determining the storage period,
– the existence of a right to rectification, erasure, restriction of processing or objection,
– the existence of a right of appeal to a supervisory authority,
– the origin of your personal data if it was not collected by us, or
– the existence of automated decision-making including profiling and, if applicable, meaningful information on its details.
Right to rectification
According to Art. 16 GDPR, you have the right to obtain from us without undue delay the rectification of inaccurate or incomplete personal data stored by us.

Right to erasure
In accordance with Art. 17 GDPR, you have the right to demand that we erase your personal data without undue delay, unless further processing is necessary for one of the following reasons:
– the personal data are still necessary for the purposes for which they were collected or otherwise processed,
– to exercise the right to freedom of expression and information,
– for compliance with a legal obligation which requires processing by European Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
– for reasons of public interest in the area of public health pursuant to Art. 9 (2) (h) and (i) and Art. 9 (3) GDPR,
– for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes pursuant to Art. 89 (1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
– for the assertion, exercise or defense of legal claims
Right to restriction
According to Art. 18 GDPR, you can request the restriction of the processing of your personal data for one of the following reasons:
– You contest the accuracy of your personal data,
– The processing is unlawful and you oppose the erasure of the personal data,
– We no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, or
– You object to the processing pursuant to Art. 21 UAbs. 1 DSGVO.
Right to information
If you have requested the correction or deletion of your personal data or a restriction of processing in accordance with Art. 16, Art. 17 UAbs. 1 and Art. 18 DSGVO, we will inform all recipients to whom your personal data has been disclosed, unless this proves impossible or involves a disproportionate effort. You can request that we inform you of these recipients.

Right to transfer
We grant you the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format.
You also have the right to request the transfer of this data to a third party, provided that the processing is carried out using automated procedures and is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR, Art. 9 para. 2 lit. a) GDPR or Art. 6 para. 1 lit. b) GDPR.

Right to withdraw consent
In accordance with Art. 7 (3) GDPR, you have the right to withdraw your consent to us at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In future, we may no longer continue the data processing based on your withdrawn consent.

Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority pursuant to Art. 77 GDPR. This depends on the federal state of your place of residence, your work or the alleged infringement. A list of supervisory authorities (for the non-public sector) with addresses can be found at: https://www.bfdi.bund.de/DE/Infothek/Anschriften_Links/anschriften_links-node.html.

Our competent supervisory authority is:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Postfach 1349
91504 Ansbach
Germany
Online complaint form: https://www.lda.bayern.de/de/beschwerde.html.

Right to object
If we process your personal data on the basis of a legitimate interest in accordance with Art. 6 (1) (f) GDPR, you have the right to object to this processing in accordance with Art. 21 GDPR if you can prove special reasons for this. These grounds may arise from your particular situation or be directed against direct advertising. In the latter case, you have a general right to object, which must be implemented by us without specifying the particular situation. You can send your right of objection or revocation directly by email to datenschutz@bkl.de.

Automated decision in individual cases including profiling
In accordance with Art. 22 GDPR, you have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you.
However, this does not apply if the decision:
1. is necessary for entering into, or the performance of, a contract between the data subject and a data controller,
2. is authorized by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or
3. is based on the data subject’s explicit consent.
In the cases referred to in 1 and 3, we will take measures to safeguard your rights and freedoms and your legitimate interests, including at least the right to obtain human intervention on our part, to express your point of view and to contest the decision.